---
id: "CVE-2026-125443"
page: "https://infrastack.ai/live/CVE-2026-125443"
kind: "vulnerability"
aliases: ["CVE-2026-125443"]
title: "WPJAM Basic WordPress plugin: DOM-based XSS through input handling"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wpjam-basic", "fixed": ["7.1.4"], "affected": "<= 7.1.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "wordpress", "wpjam-basic", "xss"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-15T14:17:24+00:00"
first_seen_at: "2026-11-15T14:36:14+00:00"
updated_at: "2026-11-15T14:39:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125443", "first_seen_at": "2026-11-15T14:36:14+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability", "first_seen_at": "2026-11-15T14:39:14+00:00", "cites": ["https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability", "https://wordpress.org/plugins/wpjam-basic/"]}]
exploit_sources: []
---

# WPJAM Basic WordPress plugin: DOM-based XSS through input handling

Link for people: https://infrastack.ai/live/CVE-2026-125443 (this .md is for agents)

WPJAM Basic, a WordPress plugin by Denishua, fails to neutralize input when it builds web pages, enabling DOM-based cross-site scripting. An attacker who gets a visitor to load a crafted page can run scripts in that visitor's browser session on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:wpjam-basic affected <= 7.1.2 fixed 7.1.4

## How to check

- In WordPress admin > Plugins, check whether WPJAM Basic (wpjam-basic) is installed and its version. Versions up to and including 7.1.2 are listed as vulnerable.
- Or run: wp plugin get wpjam-basic --field=version

## Fix

Update WPJAM Basic to 7.1.4 or later (per Patchstack; not confirmed on a vendor page).

## Timeline

- 2026-11-15T14:36:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125443
- 2026-11-15T14:39:14+00:00 analyst https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability — Patchstack (CNA, third party, not the vendor) lists <=7.1.2 vulnerable, 7.1.4 patched, published 2026-11-11; no vendor advisory found, so nothing marked verified. Code path not published.

## Documents

- [advisory] Patchstack: WPJAM Basic <= 7.1.2 XSS https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability
- [describes] WPJAM Basic - WordPress.org plugin page https://wordpress.org/plugins/wpjam-basic/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows DOM-Based XSS.This issue affects WPJAM Basic: from n/a through 7.1.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_